unkinben
3d59758324
ci/woodpecker/push/apply Pipeline was canceled
Split plugin catalog registration out of the per-engine backend modules into its own concern (previously bundled into #87's gpg_secret_backend). ## Changes - New generic `plugin` module (`vault_plugin`: type/name/command/sha256/plugin_version) that imports a binary into the catalog. - New `config/plugins/` discovery group (filename = catalog name = mount type), wired through `vault_cluster` (`plugins` variable + module) and the syd1 environment. - `config/plugins/vault-plugin-secrets-gpg.yaml` pins the released v0.1.0 binary sha256 (`0e92d740…a7b20`, from the published RPM). Puppet installs the RPM floating, so bump this in lockstep on upgrade. Any engine now registers its plugin by dropping a file in `config/plugins/`; its `*_secret_backend` module just mounts the registered type. Needs the deployer's plugin-catalog access (#88). Merge order: **#88 → this → #87**. Reviewed-on: #89 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
13 lines
501 B
Terraform
13 lines
501 B
Terraform
# Registers ("imports") a plugin binary in the Vault/OpenBao plugin catalog so
|
|
# it can be mounted. The binary must already exist in the server
|
|
# plugin_directory (installed out of band, e.g. by Puppet); `command` is its
|
|
# filename there. The sha256 must match the on-disk binary or the server refuses
|
|
# to launch the plugin.
|
|
resource "vault_plugin" "this" {
|
|
type = var.type
|
|
name = var.name
|
|
command = coalesce(var.command, var.name)
|
|
sha256 = var.sha256
|
|
version = var.plugin_version
|
|
}
|